Privacy Policy

Depending on how you use Bazarus, the service may process account information such as your email address, first name and last name, authentication information, profile information and account status.

When you use marketplace features, Bazarus may also process listing titles, descriptions, prices, locations, categories, photographs, favorites, messages, notifications, user blocks, reports and moderation-related records.

Technical information required to maintain an authenticated session or complete an account-recovery flow may also be processed.

Security activity records include browser information and, when hosted on Vercel, an approximate city and country derived by the hosting provider from your IP address. These details help you review account activity; they are not GPS location and may be inaccurate when using a VPN or mobile network. This feature does not send your IP to an additional geolocation service or store raw IP addresses in these activity records.

Personal data is used to provide account access, publish and manage marketplace listings, enable communication between users, maintain favorites and notifications, prevent abuse, process reports, enforce marketplace rules and operate security features.

Active listings are intended to be publicly visible. Public seller profiles may display a seller's first name, last-name initial, membership information and active listings.

Do not include sensitive personal information in a public listing, photograph, description or other public marketplace field.

Vercel hosts and delivers the website and runs server-side application requests. This involves processing request information, including IP addresses, and the data needed to handle the requested feature.

Bazarus currently uses Supabase infrastructure for authentication, database functionality, file storage and realtime application features.

The selected Supabase project region is Central Europe (Zurich), Switzerland.

Resend delivers account emails, such as email verification and password recovery messages. It processes recipient addresses, email content and delivery information. Infomaniak hosts the info@bazarus.ch mailbox used for support and privacy correspondence, including any attachments you send.

Infomaniak states that its mail service is hosted in Switzerland. Vercel and Resend describe processing in the United States in their data processing agreements. Choosing an email sending region does not mean that all email data stays in that region. Supabase's selected project region also does not exclude processing elsewhere by its service providers.

The full list of applicable processing countries and contractual transfer safeguards still requires confirmation for this deployment. This section is not yet a complete international-transfer disclosure.

• Vercel — DPA
• Supabase — DPA
• Resend — DPA
• Infomaniak — Privacy Policy

Bazarus uses cookies and similar browser mechanisms where they are technically necessary for authentication, session continuity and password recovery.

Optional usage measurements require your permission and are off by default. They record daily action totals, not your account, search words, messages, photos, listing IDs or precise location. See the Cookie Policy to allow or stop collection. Normal infrastructure request logs are separate from these totals.

Registered users can update certain account information through the account area. Bazarus also provides an account-deletion flow.

Account deletion includes a cleanup step for files uploaded by the account before the account itself is deleted. If cleanup fails, deletion may need to be resumed or handled with support. Archiving a notification or letting a listing expire is not the same as deleting the underlying data.

Our approved retention policy is six months after resolution for support requests and support email correspondence, and twelve months after resolution for moderation records. Reopened cases start a new period when resolved again. Necessary records relating to an ongoing dispute or a legal retention obligation may be kept longer, with the reason and continued need reviewed.

Database cleanup is scheduled daily at 03:15 UTC in batches of up to 100 eligible cases. Busy records or a backlog can delay deletion. For cases already resolved when cleanup was activated on 29 September 2026, the retention period starts on that date because reliable historical closure dates were unavailable. Support emails in the Infomaniak mailbox require separate manual review and deletion; the website does not delete them.

There is currently no single automatic deletion period for all account, marketplace, support and security records. In particular, the application does not apply a fixed age-based cleanup to account security activity. A shorter period must not be assumed simply because only recent entries are displayed.

If optional usage measurements are enabled and you consent, they store daily aggregate counts. Entries outside the current 90-day window are removed when new measurements are recorded, rather than by a scheduled daily deletion. If collection stops, older totals may remain until cleanup runs again.

Deleting data from Bazarus does not immediately erase every provider log or backup. The published limits below describe specific services, not a universal deletion deadline. Internal security records and backup deletion schedules not covered by these limits still require confirmation. Contact info@bazarus.ch about a specific record or deletion request.

Provider documentation checked on 29 September 2026 describes the following limits for our current service plans. These limits are separate from Bazarus account security activity and the support and moderation retention periods above.

• Vercel Hobby provides access to one hour of runtime logs. This visibility window is not a guarantee that all infrastructure records are erased after one hour. Vercel — Runtime Logs
• Supabase Free lists one day for API and database logs and one hour for Auth Audit Logs. Automatic database backups are not included in this plan; this does not establish that the provider holds no internal backup copies. Supabase — Plan limits
• Resend states that email and log data is retained for 30 days on its Free plan and backups for seven days. Its stored data is held in the United States, independently of the selected email sending region. Resend — Security
• The info@bazarus.ch mailbox uses Infomaniak Mail Starter. Recovery of deleted emails from provider backups is not included in this plan. This does not mean that Infomaniak holds no backup copies; the retention and erasure periods for those copies have not been confirmed for this mailbox. Infomaniak — Mailbox recovery

Depending on the law applicable to you and the circumstances of the processing, you may have rights relating to access, correction, deletion or other handling of your personal data.

For privacy questions or requests about your personal data, use the support and privacy email address in the operator details above. Never send your password or verification codes.

Bazarus uses application-level access controls and database authorization rules designed to limit access to user data. No internet service can guarantee absolute security.

This policy may change when Bazarus introduces new features or changes how personal data is processed. The date shown at the top of this page identifies the current revision.